Binance says $6.3 billion affected by theft as withdrawals remain paused

Two transfer waves precede the October 30 disclosure

Binance’s October 30 disclosure put approximately $6.3 billion in assets within the scope of a theft affecting its exchange hot wallets and withdrawal infrastructure. Its subsequent update said withdrawals remained paused and offered a tentative resumption window of approximately 45 hours. That estimate is not confirmation that service has returned. The initial notice supplied neither a customer-victim count nor a software version or CVE that customers or other operators could simply patch. [1][3]

TRM Labs traced unauthorized transfers beginning around 20:05 UTC on October 29, with most funds moving within approximately 20 minutes and another wave around 23:05 UTC. Although dated October 29, its analysis incorporates observations through 00:30 UTC on October 30. TechCrunch separately obtained an emailed Binance statement confirming the incident and withdrawal restrictions on October 29, but that earlier reporting did not establish the later $6.3 billion estimate. [2][8]

The evidence points toward abused signing infrastructure

Binance initially said a compromised DevOps laptop might have enabled access to a service container and unauthorized withdrawals. Its later update described additional entry points and a multistage attack, rather than one engineer moving funds with a single action. The company reported finding no evidence that wallet private keys had leaked. That is a statement about evidence found so far, not proof that key exposure was impossible or a complete explanation of the authorization failures. [1][3]

TRM’s transaction reconstruction provides a more specific view of the Ethereum activity. It found that the attacker submitted 50 previously signed authorizations using EIP-7702 wallet delegation. One matched the wallet’s transaction counter, allowing attacker-controlled contract code to govern the wallet. On other affected blockchains, the transfers carried valid signatures. TRM therefore assesses that the attacker accessed Binance’s signing infrastructure, since an Ethereum-only phishing explanation would not account for the cross-chain transfers. [2]

Elliptic separately found that the malicious delegation persisted and enabled additional sweeps of incoming funds. Together, the analyses support an assessment of signing-system abuse rather than a demonstrated failure of blockchain cryptography. They do not establish precisely which internal Binance control failed. The defensive inference is that keeping keys secret is insufficient if compromised systems can still obtain legitimate signatures for unauthorized transactions. [2][4]

Frozen assets are not recovered assets

The financial estimates remain provisional. Binance reports approximately $6.3 billion affected; TRM calculates $6.36 billion at transfer-time prices; Elliptic calculates $6.43 billion. The Hacker News also cites an earlier Chainalysis estimate of $5.912 billion at the time of theft. The available accounts do not fully reconcile their transaction selections and valuations, so price movement alone cannot be presented as the explanation. Approximately $6.3 billion is a useful description of the disclosed scale, not a finalized audited loss. [1][2][4][5]

Freeze estimates also differ: roughly $2.7 billion from TRM, $2.84 billion verified by Elliptic using an approximately 07:00 UTC October 30 snapshot, and about $3 billion reported by Binance. These are separate observations, not interchangeable recovery totals. Frozen funds have not necessarily been returned, so subtracting them from the theft estimate would misstate the final loss. Elliptic also distinguishes issuer-freezable tokens from native assets such as bitcoin and ether, which lack an issuer able to impose equivalent freezes. [1][2][4]

Separate tracing strengthens the account, but attribution remains open

The strongest corroboration comes from the distinct roles of the sources. Binance acknowledges the incident and describes its operational response, but remains an interested party. TRM and Elliptic contribute separate transaction analyses, independently calculated totals and assessments of signing-system abuse. Their work corroborates large unauthorized transfers without verifying every detail of Binance’s internal account. TechCrunch’s direct company contact confirms that Binance acknowledged the incident; it is not another independent forensic reconstruction. Articles repeating company statements should not be counted as additional technical corroboration. [1][2][4][8]

TRM attributes the attack to North Korea’s TraderTraitor with high confidence. Elliptic independently attributes it to North Korea, citing evidence including funds reaching an address associated with a suspected North Korean Bitget exploit. Binance did not confirm that attribution to the Associated Press. Its spokesperson said investigators were working with law enforcement to establish the perpetrators’ identities. The researchers’ assessments are substantial evidence, but they are not a company or government confirmation of responsibility. [2][4][7]

Customers face unresolved access and coverage questions

The latest reviewed Binance position is that deposits are operating while withdrawals remain paused. Its account contains an unresolved inconsistency: the initial notice said both deposits and withdrawals were suspended, while the subsequent update said deposits had remained unaffected throughout. Customers should rely on authenticated company updates for current availability. Operating deposits do not establish that remediation is complete or that customers can withdraw funds. [1][3][6]

Binance has pledged to cover losses through its Secure Asset Fund for Users and company resources, and to publish updated proof of reserves after remediation. Those commitments matter, but neither demonstrates completed reimbursement or restored reserves. For customers, the immediate questions are when withdrawal access actually returns and how the coverage pledge is fulfilled. The disclosed asset estimate does not establish how many individual customers suffered losses. [1][6]

Review authorization controls and demand evidence of restoration

For exchanges and custodians, the practical inference is to review the entire transaction-authorization path, not only private-key storage. The reported laptop and service-container access make service permissions relevant; the validly signed transfers make signing permissions relevant; and Elliptic’s persistent-delegation finding makes wallet delegations relevant. These are defensive priorities inferred from the preliminary evidence, not a confirmed remediation recipe for Binance. A review focused only on whether keys were exported could miss the form of authorization abuse described by the researchers. [1][2][3][4]

The next meaningful milestones are verified withdrawal restoration, a technical post-mortem establishing the entry points and authorization failures, and evidence that frozen assets have actually been recovered. Updated reserves and fulfilled loss coverage would help test Binance’s financial commitments. Attribution would become firmer with a formal finding supported by disclosed evidence. Until then, the core incident and continuing disruption are established, while the precise loss, internal attack sequence, ultimate recovery and perpetrators remain subject to further findings. [1][3][4]